Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a32dae2932f1b78…

MALICIOUS

PDF

85.3 KB Created: 2021-06-09 21:03:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6179e391ff72fe224a56373032ba373c SHA-1: 763ace991a7bbe758995f11876741d2d40029f70 SHA-256: 0a32dae2932f1b78989641d2e29164495971f390a5821f0e6a334fdbfaf027ce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains a URL leading to a phishing site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to a lab report, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/pbw?utm_term=fluid+friction+apparatus+lab+report
    • https://cdn-cms.f-static.net/uploads/4454562/normal_60501e393d521.pdf
    • https://cdn-cms.f-static.net/uploads/4425238/normal_602ce1aeb5051.pdf
    • https://static.s123-cdn-static.com/uploads/4466657/normal_5ff76904e9e81.pdf
    • https://static.s123-cdn-static-d.com/uploads/4392474/normal_60b56ef7eb0c7.pdf
    • https://cdn-cms.f-static.net/uploads/4365649/normal_602f437ebb9bf.pdf
    • https://cdn-cms.f-static.net/uploads/4463785/normal_605f7f4db5195.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sajateves.pbworks.com/f/85021910606.pdf
    • https://uploads.strikinglycdn.com/files/8c513dc2-a9ba-411f-9653-39445b9166dc/gedesobijiroge.pdf
    • https://uploads.strikinglycdn.com/files/ff437e48-2c7d-401b-ac27-4cd2d73fc6d8/derecho_internacional_publico_carlos_arellano_garcia.pdf
    • http://lopofemusun.pbworks.com/w/file/fetch/144518772/nizobogepaxijaru.pdf
    • http://savavaze.pbworks.com/w/file/fetch/144461685/vipijafiwetepadow.pdf
    • http://pezeliv.pbworks.com/w/file/fetch/144913875/laxmikanth_notes.pdf
    • http://mutoteja.pbworks.com/w/file/fetch/144811344/dibosunof.pdf
    • http://gatunam.pbworks.com/w/file/fetch/144558258/how_to_download_xforce_keygen_revit_2020.pdf
    • https://uploads.strikinglycdn.com/files/9f485b88-c413-4512-90d1-7da3e6d20fb1/xafulukupesozufabokuvosu.pdf
    • https://uploads.strikinglycdn.com/files/b4f3fad2-c151-4142-a8b2-ecb20ea23970/questoes_sobre_termometria_enem.pdf
    • https://uploads.strikinglycdn.com/files/eab67602-b31a-4c96-90d0-f1118be4e737/descargar_libro_ficciones_de_jorge_luis_borges.pdf
    • https://uploads.strikinglycdn.com/files/e2e09bad-8f1e-431f-8596-d6cef85a3f8f/buenos_dias_princesa_de_dios_imagenes.pdf
    • https://uploads.strikinglycdn.com/files/11f27e33-199b-4f8c-9c03-05f12ef2c358/refokomapolebesefimuruta.pdf
    • http://maxasol.pbworks.com/w/file/fetch/144683748/flag_page_test.pdf
    • https://uploads.strikinglycdn.com/files/52b0f353-b4c9-435f-8faf-5e1b29c3a4e9/70260672960.pdf
    • http://mutoteja.pbworks.com/f/diamantes_gratis_para_free_fire_apk_2021.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9af.bin
c61c9fae5fb06c562a1124a4966ab073965a8c82dadc341f2c0e8166272de02b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9AF 5244 bytes
font_01_sfnt_off00010b8b.bin
b4cbecf622fe6af2ad47f4f928e3651077468a279ca1b6064bd57176f01cc5b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B8B 11496 bytes
font_02_sfnt_off000132c3.bin
d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132C3 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.